FreeRDP, an open-source RDP client, contains numerous memory corruption and use-after-free vulnerabilities (including CVE-2026-22852 and 22 others) that could lead to denial of service or arbitrary code execution. These vulnerabilities affect multiple components such as FastGlyph parsing, audio formats, video timers, and RDP message handling. The vulnerabilities are present in FreeRDP versions shipped with Red Hat Enterprise Linux 10 and its derivatives. Red Hat has released security updates to fix these issues as detailed in advisory RHSA-2026:19033.

Successful exploitation of these vulnerabilities could allow an attacker to cause denial of service or execute arbitrary code on systems running vulnerable FreeRDP clients. This could compromise the confidentiality, integrity, and availability of affected systems. The vulnerabilities affect the client side of RDP connections, potentially exposing users connecting to malicious or compromised RDP servers.

Red Hat has released security updates for FreeRDP in Red Hat Enterprise Linux 10 and related products to address these vulnerabilities. Users should apply the updates as described in Red Hat advisory RHSA-2026:19033 (https://access.redhat.com/articles/11258) to remediate the issues. Patch status is confirmed with official fixes available. No additional vendor mitigation guidance indicates that these updates fully address the vulnerabilities.